Skip to content

Commit 40850c9

Browse files
ssrish17maddy-kerneldev
authored andcommitted
powerpc/pseries: move the PLPKS config inside its own sysfs directory
The /sys/firmware/secvar/config directory represents Power LPAR Platform KeyStore (PLPKS) configuration properties such as max_object_size, signed_ update_algorithms, supported_policies, total_size, used_space, and version. These attributes describe the PLPKS, and not the secure boot variables (secvars). Create /sys/firmware/plpks directory and move the PLPKS config inside this directory. For backwards compatibility, create a soft link from the secvar sysfs directory to this config and emit a warning stating that the older sysfs path has been deprecated. Separate out the plpks specific documentation from secvar. Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com> Tested-by: Nayna Jain <nayna@linux.ibm.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Reviewed-by: Nayna Jain <nayna@linux.ibm.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260127145228.48320-3-ssrish@linux.ibm.com
1 parent 88372ad commit 40850c9

8 files changed

Lines changed: 156 additions & 111 deletions

File tree

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
What: /sys/firmware/plpks/config
2+
Date: February 2023
3+
Contact: Nayna Jain <nayna@linux.ibm.com>
4+
Description: This optional directory contains read-only config attributes as
5+
defined by the PLPKS implementation. All data is in ASCII
6+
format.
7+
8+
What: /sys/firmware/plpks/config/version
9+
Date: February 2023
10+
Contact: Nayna Jain <nayna@linux.ibm.com>
11+
Description: Config version as reported by the hypervisor in ASCII decimal
12+
format.
13+
14+
What: /sys/firmware/plpks/config/max_object_size
15+
Date: February 2023
16+
Contact: Nayna Jain <nayna@linux.ibm.com>
17+
Description: Maximum allowed size of objects in the keystore in bytes,
18+
represented in ASCII decimal format.
19+
20+
This is not necessarily the same as the max size that can be
21+
written to an update file as writes can contain more than
22+
object data, you should use the size of the update file for
23+
that purpose.
24+
25+
What: /sys/firmware/plpks/config/total_size
26+
Date: February 2023
27+
Contact: Nayna Jain <nayna@linux.ibm.com>
28+
Description: Total size of the PLPKS in bytes, represented in ASCII decimal
29+
format.
30+
31+
What: /sys/firmware/plpks/config/used_space
32+
Date: February 2023
33+
Contact: Nayna Jain <nayna@linux.ibm.com>
34+
Description: Current space consumed by the key store, in bytes, represented
35+
in ASCII decimal format.
36+
37+
What: /sys/firmware/plpks/config/supported_policies
38+
Date: February 2023
39+
Contact: Nayna Jain <nayna@linux.ibm.com>
40+
Description: Bitmask of supported policy flags by the hypervisor, represented
41+
as an 8 byte hexadecimal ASCII string. Consult the hypervisor
42+
documentation for what these flags are.
43+
44+
What: /sys/firmware/plpks/config/signed_update_algorithms
45+
Date: February 2023
46+
Contact: Nayna Jain <nayna@linux.ibm.com>
47+
Description: Bitmask of flags indicating which algorithms the hypervisor
48+
supports for signed update of objects, represented as a 16 byte
49+
hexadecimal ASCII string. Consult the hypervisor documentation
50+
for what these flags mean.

Documentation/ABI/testing/sysfs-secvar

Lines changed: 0 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -63,68 +63,3 @@ Contact: Nayna Jain <nayna@linux.ibm.com>
6363
Description: A write-only file that is used to submit the new value for the
6464
variable. The size of the file represents the maximum size of
6565
the variable data that can be written.
66-
67-
What: /sys/firmware/secvar/config
68-
Date: February 2023
69-
Contact: Nayna Jain <nayna@linux.ibm.com>
70-
Description: This optional directory contains read-only config attributes as
71-
defined by the secure variable implementation. All data is in
72-
ASCII format. The directory is only created if the backing
73-
implementation provides variables to populate it, which at
74-
present is only PLPKS on the pseries platform.
75-
76-
What: /sys/firmware/secvar/config/version
77-
Date: February 2023
78-
Contact: Nayna Jain <nayna@linux.ibm.com>
79-
Description: Config version as reported by the hypervisor in ASCII decimal
80-
format.
81-
82-
Currently only provided by PLPKS on the pseries platform.
83-
84-
What: /sys/firmware/secvar/config/max_object_size
85-
Date: February 2023
86-
Contact: Nayna Jain <nayna@linux.ibm.com>
87-
Description: Maximum allowed size of objects in the keystore in bytes,
88-
represented in ASCII decimal format.
89-
90-
This is not necessarily the same as the max size that can be
91-
written to an update file as writes can contain more than
92-
object data, you should use the size of the update file for
93-
that purpose.
94-
95-
Currently only provided by PLPKS on the pseries platform.
96-
97-
What: /sys/firmware/secvar/config/total_size
98-
Date: February 2023
99-
Contact: Nayna Jain <nayna@linux.ibm.com>
100-
Description: Total size of the PLPKS in bytes, represented in ASCII decimal
101-
format.
102-
103-
Currently only provided by PLPKS on the pseries platform.
104-
105-
What: /sys/firmware/secvar/config/used_space
106-
Date: February 2023
107-
Contact: Nayna Jain <nayna@linux.ibm.com>
108-
Description: Current space consumed by the key store, in bytes, represented
109-
in ASCII decimal format.
110-
111-
Currently only provided by PLPKS on the pseries platform.
112-
113-
What: /sys/firmware/secvar/config/supported_policies
114-
Date: February 2023
115-
Contact: Nayna Jain <nayna@linux.ibm.com>
116-
Description: Bitmask of supported policy flags by the hypervisor,
117-
represented as an 8 byte hexadecimal ASCII string. Consult the
118-
hypervisor documentation for what these flags are.
119-
120-
Currently only provided by PLPKS on the pseries platform.
121-
122-
What: /sys/firmware/secvar/config/signed_update_algorithms
123-
Date: February 2023
124-
Contact: Nayna Jain <nayna@linux.ibm.com>
125-
Description: Bitmask of flags indicating which algorithms the hypervisor
126-
supports for signed update of objects, represented as a 16 byte
127-
hexadecimal ASCII string. Consult the hypervisor documentation
128-
for what these flags mean.
129-
130-
Currently only provided by PLPKS on the pseries platform.

arch/powerpc/include/asm/plpks.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313

1414
#include <linux/types.h>
1515
#include <linux/list.h>
16+
#include <linux/kobject.h>
1617

1718
// Object policy flags from supported_policies
1819
#define PLPKS_OSSECBOOTAUDIT PPC_BIT32(1) // OS secure boot must be audit/enforce
@@ -107,11 +108,15 @@ u16 plpks_get_passwordlen(void);
107108
void plpks_early_init_devtree(void);
108109

109110
int plpks_populate_fdt(void *fdt);
111+
112+
int plpks_config_create_softlink(struct kobject *from);
110113
#else // CONFIG_PSERIES_PLPKS
111114
static inline bool plpks_is_available(void) { return false; }
112115
static inline u16 plpks_get_passwordlen(void) { BUILD_BUG(); }
113116
static inline void plpks_early_init_devtree(void) { }
114117
static inline int plpks_populate_fdt(void *fdt) { BUILD_BUG(); }
118+
static inline int plpks_config_create_softlink(struct kobject *from)
119+
{ return 0; }
115120
#endif // CONFIG_PSERIES_PLPKS
116121

117122
#endif // _ASM_POWERPC_PLPKS_H

arch/powerpc/include/asm/secvar.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ struct secvar_operations {
2020
int (*set)(const char *key, u64 key_len, u8 *data, u64 data_size);
2121
ssize_t (*format)(char *buf, size_t bufsize);
2222
int (*max_size)(u64 *max_size);
23-
const struct attribute **config_attrs;
2423

2524
// NULL-terminated array of fixed variable names
2625
// Only used if get_next() isn't provided

arch/powerpc/kernel/secvar-sysfs.c

Lines changed: 6 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
#include <linux/string.h>
1313
#include <linux/of.h>
1414
#include <asm/secvar.h>
15+
#include <asm/plpks.h>
1516

1617
#define NAME_MAX_SIZE 1024
1718

@@ -145,19 +146,6 @@ static __init int update_kobj_size(void)
145146
return 0;
146147
}
147148

148-
static __init int secvar_sysfs_config(struct kobject *kobj)
149-
{
150-
struct attribute_group config_group = {
151-
.name = "config",
152-
.attrs = (struct attribute **)secvar_ops->config_attrs,
153-
};
154-
155-
if (secvar_ops->config_attrs)
156-
return sysfs_create_group(kobj, &config_group);
157-
158-
return 0;
159-
}
160-
161149
static __init int add_var(const char *name)
162150
{
163151
struct kobject *kobj;
@@ -260,12 +248,15 @@ static __init int secvar_sysfs_init(void)
260248
goto err;
261249
}
262250

263-
rc = secvar_sysfs_config(secvar_kobj);
251+
rc = plpks_config_create_softlink(secvar_kobj);
264252
if (rc) {
265-
pr_err("Failed to create config directory\n");
253+
pr_err("Failed to create softlink to PLPKS config directory");
266254
goto err;
267255
}
268256

257+
pr_info("/sys/firmware/secvar/config is now deprecated.\n");
258+
pr_info("Will be removed in future versions.\n");
259+
269260
if (secvar_ops->get_next)
270261
rc = secvar_sysfs_load();
271262
else

arch/powerpc/platforms/pseries/Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ obj-$(CONFIG_PAPR_SCM) += papr_scm.o
3030
obj-$(CONFIG_PPC_SPLPAR) += vphn.o
3131
obj-$(CONFIG_PPC_SVM) += svm.o
3232
obj-$(CONFIG_FA_DUMP) += rtas-fadump.o
33-
obj-$(CONFIG_PSERIES_PLPKS) += plpks.o
33+
obj-$(CONFIG_PSERIES_PLPKS) += plpks.o plpks-sysfs.o
3434
obj-$(CONFIG_PPC_SECURE_BOOT) += plpks-secvar.o
3535
obj-$(CONFIG_PSERIES_PLPKS_SED) += plpks_sed_ops.o
3636
obj-$(CONFIG_SUSPEND) += suspend.o

arch/powerpc/platforms/pseries/plpks-secvar.c

Lines changed: 0 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -20,33 +20,6 @@
2020
#include <asm/secvar.h>
2121
#include <asm/plpks.h>
2222

23-
// Config attributes for sysfs
24-
#define PLPKS_CONFIG_ATTR(name, fmt, func) \
25-
static ssize_t name##_show(struct kobject *kobj, \
26-
struct kobj_attribute *attr, \
27-
char *buf) \
28-
{ \
29-
return sysfs_emit(buf, fmt, func()); \
30-
} \
31-
static struct kobj_attribute attr_##name = __ATTR_RO(name)
32-
33-
PLPKS_CONFIG_ATTR(version, "%u\n", plpks_get_version);
34-
PLPKS_CONFIG_ATTR(max_object_size, "%u\n", plpks_get_maxobjectsize);
35-
PLPKS_CONFIG_ATTR(total_size, "%u\n", plpks_get_totalsize);
36-
PLPKS_CONFIG_ATTR(used_space, "%u\n", plpks_get_usedspace);
37-
PLPKS_CONFIG_ATTR(supported_policies, "%08x\n", plpks_get_supportedpolicies);
38-
PLPKS_CONFIG_ATTR(signed_update_algorithms, "%016llx\n", plpks_get_signedupdatealgorithms);
39-
40-
static const struct attribute *config_attrs[] = {
41-
&attr_version.attr,
42-
&attr_max_object_size.attr,
43-
&attr_total_size.attr,
44-
&attr_used_space.attr,
45-
&attr_supported_policies.attr,
46-
&attr_signed_update_algorithms.attr,
47-
NULL,
48-
};
49-
5023
static u32 get_policy(const char *name)
5124
{
5225
if ((strcmp(name, "db") == 0) ||
@@ -225,7 +198,6 @@ static const struct secvar_operations plpks_secvar_ops_static = {
225198
.set = plpks_set_variable,
226199
.format = plpks_secvar_format,
227200
.max_size = plpks_max_size,
228-
.config_attrs = config_attrs,
229201
.var_names = plpks_var_names_static,
230202
};
231203

@@ -234,7 +206,6 @@ static const struct secvar_operations plpks_secvar_ops_dynamic = {
234206
.set = plpks_set_variable,
235207
.format = plpks_secvar_format,
236208
.max_size = plpks_max_size,
237-
.config_attrs = config_attrs,
238209
.var_names = plpks_var_names_dynamic,
239210
};
240211

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
// SPDX-License-Identifier: GPL-2.0-only
2+
/*
3+
* Copyright (C) 2025 IBM Corporation, Srish Srinivasan <ssrish@linux.ibm.com>
4+
*
5+
* This code exposes PLPKS config to user via sysfs
6+
*/
7+
8+
#define pr_fmt(fmt) "plpks-sysfs: "fmt
9+
10+
#include <linux/init.h>
11+
#include <linux/printk.h>
12+
#include <linux/types.h>
13+
#include <asm/machdep.h>
14+
#include <asm/plpks.h>
15+
16+
/* config attributes for sysfs */
17+
#define PLPKS_CONFIG_ATTR(name, fmt, func) \
18+
static ssize_t name##_show(struct kobject *kobj, \
19+
struct kobj_attribute *attr, \
20+
char *buf) \
21+
{ \
22+
return sysfs_emit(buf, fmt, func()); \
23+
} \
24+
static struct kobj_attribute attr_##name = __ATTR_RO(name)
25+
26+
PLPKS_CONFIG_ATTR(version, "%u\n", plpks_get_version);
27+
PLPKS_CONFIG_ATTR(max_object_size, "%u\n", plpks_get_maxobjectsize);
28+
PLPKS_CONFIG_ATTR(total_size, "%u\n", plpks_get_totalsize);
29+
PLPKS_CONFIG_ATTR(used_space, "%u\n", plpks_get_usedspace);
30+
PLPKS_CONFIG_ATTR(supported_policies, "%08x\n", plpks_get_supportedpolicies);
31+
PLPKS_CONFIG_ATTR(signed_update_algorithms, "%016llx\n",
32+
plpks_get_signedupdatealgorithms);
33+
34+
static const struct attribute *config_attrs[] = {
35+
&attr_version.attr,
36+
&attr_max_object_size.attr,
37+
&attr_total_size.attr,
38+
&attr_used_space.attr,
39+
&attr_supported_policies.attr,
40+
&attr_signed_update_algorithms.attr,
41+
NULL,
42+
};
43+
44+
static struct kobject *plpks_kobj, *plpks_config_kobj;
45+
46+
int plpks_config_create_softlink(struct kobject *from)
47+
{
48+
if (!plpks_config_kobj)
49+
return -EINVAL;
50+
return sysfs_create_link(from, plpks_config_kobj, "config");
51+
}
52+
53+
static __init int plpks_sysfs_config(struct kobject *kobj)
54+
{
55+
struct attribute_group config_group = {
56+
.name = NULL,
57+
.attrs = (struct attribute **)config_attrs,
58+
};
59+
60+
return sysfs_create_group(kobj, &config_group);
61+
}
62+
63+
static __init int plpks_sysfs_init(void)
64+
{
65+
int rc;
66+
67+
if (!plpks_is_available())
68+
return -ENODEV;
69+
70+
plpks_kobj = kobject_create_and_add("plpks", firmware_kobj);
71+
if (!plpks_kobj) {
72+
pr_err("Failed to create plpks kobj\n");
73+
return -ENOMEM;
74+
}
75+
76+
plpks_config_kobj = kobject_create_and_add("config", plpks_kobj);
77+
if (!plpks_config_kobj) {
78+
pr_err("Failed to create plpks config kobj\n");
79+
kobject_put(plpks_kobj);
80+
return -ENOMEM;
81+
}
82+
83+
rc = plpks_sysfs_config(plpks_config_kobj);
84+
if (rc) {
85+
pr_err("Failed to create attribute group for plpks config\n");
86+
kobject_put(plpks_config_kobj);
87+
kobject_put(plpks_kobj);
88+
return rc;
89+
}
90+
91+
return 0;
92+
}
93+
94+
machine_subsys_initcall(pseries, plpks_sysfs_init);

0 commit comments

Comments
 (0)